diff options
| author | Artem Bityutskiy <Artem.Bityutskiy@nokia.com> | 2008-07-13 21:46:24 +0300 |
|---|---|---|
| committer | Artem Bityutskiy <Artem.Bityutskiy@nokia.com> | 2008-07-24 13:32:56 +0300 |
| commit | a6ea440769e11c46828cddd20f91ab57261701d5 (patch) | |
| tree | 19994608d2721de6484310c60e4a3ff1414cb1ef /drivers/mtd/ubi/cdev.c | |
| parent | a5bf6190417cbbf80443a9f71c65b653e13e9982 (diff) | |
UBI: improve mkvol request validation
Check that volume name is not shorter than 'name_len'.
No need to copy the trailing zero byte because whole array
was zeroed earlier.
Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
Diffstat (limited to 'drivers/mtd/ubi/cdev.c')
| -rw-r--r-- | drivers/mtd/ubi/cdev.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/drivers/mtd/ubi/cdev.c b/drivers/mtd/ubi/cdev.c index 3e3449ec07f0..4fb84e3e6502 100644 --- a/drivers/mtd/ubi/cdev.c +++ b/drivers/mtd/ubi/cdev.c @@ -574,6 +574,10 @@ static int verify_mkvol_req(const struct ubi_device *ubi, goto bad; } + n = strnlen(req->name, req->name_len + 1); + if (n != req->name_len) + goto bad; + return 0; bad: @@ -629,12 +633,11 @@ static int ubi_cdev_ioctl(struct inode *inode, struct file *file, break; } + req.name[req.name_len] = '\0'; err = verify_mkvol_req(ubi, &req); if (err) break; - req.name[req.name_len] = '\0'; - mutex_lock(&ubi->volumes_mutex); err = ubi_create_volume(ubi, &req); mutex_unlock(&ubi->volumes_mutex); |